PDN
Match being pirated right now?Client portalFree scan

Booby-trapped Android boxes: 1.3 million TV boxes turned into relays for criminals

6 min read

Illustration for the article: Booby-trapped Android boxes: 1.3 million TV boxes turned into relays for criminals

On November 2, 2026, Google announced that, the week before, it had dismantled a network of compromised machines hidden in more than 1.3 million Android TV boxes. The software involved, called XCPE (or x.cpe), had not been installed by a passing hacker: according to Google, it shipped from the factory, in the devices’ firmware, and was operated by their manufacturer.

For us, as we take down listings for “all-inclusive boxes” every week, the case is worth a closer look: the cheap set-top box is also the basic hardware of pirate IPTV.

What Google found

According to the report by its Threat Intelligence Group and the one by security firm TrendAI, both published the same day:

  • The scale: more than 1.3 million devices according to the partners in the operation. TrendAI, for its part, counted 1,472,554 infected devices across 206 models, in more than 170 countries, between June 3 and October 1, 2026. These figures are minimums.
  • The devices: overwhelmingly Android TV boxes, but also projectors, telehealth devices, karaoke machines and digital signage screens.
  • Canada is affected: according to TrendAI, the United States, Germany, the United Kingdom, Australia and Canada each had between 26,000 and 42,000 infected devices. Malaysia, Brazil, Iraq, Mexico and Taiwan top the list.
  • The manufacturer: Google names Videostrong Technology, a Shenzhen manufacturer that designs and produces devices for other brands. Google assesses “with high confidence” that the backdoor was developed and operated by this manufacturer for profit, and that it sold access to criminal affiliates. The firm Synthient reached the same conclusion. No response from Videostrong had been reported at the time of writing.

What these boxes were used for

While their owners were watching TV, the boxes were working for someone else:

  • Relays for criminals (“residential proxies”): third-party traffic went through the household’s connection. To a targeted site, an attack then seems to come from an ordinary Vidéotron, Bell or Rogers subscriber, not from a suspicious server. TrendAI recorded more than 3.8 million distinct home and mobile addresses used this way over four months.
  • Ad fraud: modules faked views of online ads.
  • Spying on the device: according to Google, the backdoor could take screenshots, simulate keystrokes, send out account information and open remote access.
  • Silent installs: it turned off Google Play Protect app verification to install other software without asking. TrendAI counted more than 187,000 such installs.

Google and TrendAI list more than a dozen malware families loaded this way, including NetNut, another relay network that Google and the FBI had already hit on July 2, 2026, and which also relied on about 2 million smart TVs and streaming boxes.

Why they cannot be cleaned

XCPE is installed in the system, with the highest privileges. The user cannot remove it: if it is uninstalled, it comes back on reboot. Google and TrendAI both say so. The firm Plume recommends a full factory reset, without saying whether it is enough; Synthient, for its part, advises throwing these boxes away and has published a list of 182 model names, warning that the name alone does not prove infection.

Google certification was no guarantee: according to Plume, the network also included certified devices. According to Google, the malicious code loaded after the first boot, which let it slip through its tests. Google has since banned Videostrong and its future subsidiaries from building certified devices, had the command domains and servers taken down through legal action, and says it has cut off access to at least 10 million other compromised devices.

Our view: the hidden cost of the cheap box

Neither Google nor TrendAI mentions pirate IPTV, and nothing indicates that Videostrong’s boxes were sold with illegal subscriptions. The link lies elsewhere: it is the same kind of device.

In our daily searches on Marketplace, Kijiji or Facebook groups, the pirate offer almost always looks the same: an Android box with no well-known brand, “unlocked,” shipped with an app that gives thousands of channels for a few dozen dollars a month. That was the model in the Arubox case in Quebec. These devices come from the same low-cost supply chains as those targeted here, and the TV app that comes with them is installed outside the official stores, and therefore outside Google’s checks.

The customer of a pirate subscription is therefore taking two risks the seller does not mention: breaking the law, and plugging into their home network a device they do not control, which can serve as a relay for criminals or go through their accounts. The $20-a-month “all-inclusive” deal sometimes includes more than expected.

What we recommend

To consumers, drawing on the advice from Google and TrendAI:

  • buy a box from a recognized brand, certified for Android TV (Google publishes the list of partners on android.com);
  • be wary of any device or app that asks you to turn off Google Play Protect;
  • turn down apps that offer to pay you for “sharing your bandwidth”;
  • unplug an unbranded box whose origin you do not know.

To rights holders and broadcasters: the illicit set-top box is not just lost revenue, it is also a security risk for the public. That is a useful argument with the classified ad platforms we ask to remove these offers.

Sources

On the same topic

Is your content pirated? We can get it removed.

Talk to an expert1 833 967-1334